CVE-2019-6172

published 2019-11-12

CVE-2019-6172: A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad…

Priority P4 29 medium 6.4 CVSS 3.1

AV L AC H PR H UI N S U C H I H A H

A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
lenovo	thinkpad	>= Various < Various	Various
lenovo	thinkpad_helix_firmware	< gfet65ww	gfet65ww
lenovo	thinkpad_s531_firmware	< gket46ww	gket46ww
lenovo	thinkpad_t440_firmware	< gjeta3ww	gjeta3ww
lenovo	thinkpad_t440p_firmware	< gleta0ww	gleta0ww
lenovo	thinkpad_t440s_firmware	< gjeta3ww	gjeta3ww
lenovo	thinkpad_t540p_firmware	< gmet89ww	gmet89ww
lenovo	thinkpad_w540_firmware	< gnet92ww	gnet92ww
lenovo	thinkpad_w541_firmware	< gnet92ww	gnet92ww
lenovo	thinkpad_x240_firmware	< giet98ww	giet98ww
lenovo	thinkpad_x240s_firmware	< giet98ww	giet98ww

CVSS provenance

nvd v3.1 6.4 MEDIUM CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.4 MEDIUM AV:L/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.